Prior to ColdFusion 10, to write or append to a file one had to specify the file content in the output attribute of CFFILE tag. In ColdFusion 10, you can specify the file content in the body of the cffile tag. In cases where the file content is specified in body as well as in the output attribute, the output attribute would be ignored.
Example:
As observed, the output attribute would be ignored when the file content is specified in the tag body. The above example is also applicable when the action attribute is set to append. This enhancement makes it easy to write any data to a file without having to use the CFSAVECONTENT tag and a temporary variable.
Another important thing to note here is that the output attribute is now optional when action is write\append. However, it is a mandatory attribute when the closing CFFILE tag is not specified:
Example:
<!--- output attribute will be ignored here --->
<cffile action="write" file="#expandPath("./files/employees.txt")#" output="cffile content">
<?xml version='1.0' encoding='UTF-8'?>
<employees>
<id = "1">
<firstname>Sagar</firstname>
<lastname>Ganatra</lastname>
</id>
</employees>
</cffile>
As observed, the output attribute would be ignored when the file content is specified in the tag body. The above example is also applicable when the action attribute is set to append. This enhancement makes it easy to write any data to a file without having to use the CFSAVECONTENT tag and a temporary variable.
Another important thing to note here is that the output attribute is now optional when action is write\append. However, it is a mandatory attribute when the closing CFFILE tag is not specified:
<!--- Output attribute is mandatory when the closing tag is not specified --->
<cffile action="write" file="#expandPath("./files/employees.txt")#" output="No body" >
This is certainly a nice enhancement, however, does it actually validate that the *content* of the file matches the mim type, or is it simply checking the value of the mime-type header that is sent by the client? Simply checking the value of the mime-type header without validating the content of the file doesn't really add much security, since it's easy to fake that header.
ReplyDelete@ec42b1f555169f2e36a71b3bf2249187 did you see this post:
ReplyDeletehttp://www.sagarganatra.com/2012/03/coldfusion-10-cffile-restricting-file.html. Now you can validate the content when you upload a file to the server.